Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78361 | critical | 9.1 | No | The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its f... | 2026-09-10 |
| CVE-2026-77771 | high | 7.5 | No | The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit... | 2026-09-10 |
| CVE-2026-77770 | critical | 10.0 | No | The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction befor... | 2026-09-10 |
| CVE-2026-19840 | medium | 6.5 | No | The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option... | 2026-09-10 |
| CVE-2026-19439 | high | 7.5 | No | The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card detai... | 2026-09-10 |
| CVE-2026-19436 | high | 7.5 | No | The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues agains... | 2026-09-10 |
| CVE-2026-61688 | medium | 6.5 | No | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any oth... | 2026-09-10 |
| CVE-2026-61686 | high | 7.5 | No | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value... | 2026-09-10 |
| CVE-2026-61614 | medium | 5.9 | No | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=`... | 2026-09-10 |
| CVE-2026-61608 | medium | 6.8 | No | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation li... | 2026-09-10 |
| CVE-2026-81975 | high | 7.8 | No | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current use... | 2026-09-10 |
| CVE-2026-81976 | high | 7.8 | No | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current use... | 2026-09-10 |
| CVE-2026-81978 | medium | 5.5 | No | Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could lever... | 2026-09-10 |
| CVE-2026-81979 | high | 7.8 | No | Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curre... | 2026-09-10 |
| CVE-2026-81980 | high | 7.8 | No | Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curre... | 2026-09-10 |
| CVE-2026-81354 | high | 8.2 | No | Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally. | 2026-09-10 |
| CVE-2026-83498 | high | 7.8 | No | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges loc... | 2026-09-10 |
| CVE-2026-83939 | high | 8.2 | No | Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | 2026-09-10 |
| CVE-2026-81981 | high | 7.8 | No | Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curre... | 2026-09-10 |
| CVE-2026-81983 | high | 7.8 | No | Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curre... | 2026-09-10 |